23e425b11f7b2922eff9123cbf536cf77cddb7ff04e8624b05f2d8eb724a9174

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/license.rtf
Size

14KB
MD5

bdd1a53db450677d89af3be58613bd7c
SHA1

307448533dd05a409e4e47cb95d4031ed44ee32f
SHA256

76074e62dfccbfa1c73e55e5a25c4cb962f6568228c0e6aeb587bb82ace49255
SHA512

3f41a1e9e2f55331a5e34ac3f871867aeda605989fc4f739a2b26f2d8290dcd3b8a59d780a6f727a8e05874d4c3375b7d32e92080f7ab5699489953a9b821daf
SSDEEP

192:a2VSPIiNgdCHjJnBmrFyaX22umDuPvmmwadcXBya:aKSgU3mrFyaOfwRt

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1740	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1740	WINWORD.EXE
1740	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2740	1740	WINWORD.EXE	31
PID 1740 wrote to memory of 2740	1740	WINWORD.EXE	31
PID 1740 wrote to memory of 2740	1740	WINWORD.EXE	31
PID 1740 wrote to memory of 2740	1740	WINWORD.EXE	31

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$TEMP\license.rtf"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
631958efd91326781626ea0d79f2639b

SHA1
176f9dc9f02e0145be2d8cf35292e5d390656812

SHA256
7916ef9bc82044926fd3f88e72a7a7ae5fdcf2fc9db135ad187dd9b6c65dd6df

SHA512
5f3ce3d5bcadf6d9b3eb9e65d2022ce33bdf206b22607d5d7a6ef175a7092834f763b1b595127e7fa6119866bc51b40e56ef994c13c71c582230a48622132e5c

Download Submit
memory/1740-0-0x000000002FC51000-0x000000002FC52000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1740-2-0x0000000070D0D000-0x0000000070D18000-memory.dmp

Filesize
44KB

Download
memory/1740-5-0x0000000070D0D000-0x0000000070D18000-memory.dmp

Filesize
44KB

Download
memory/1740-23-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download